# How to reduce indices space?
**URL:** https://discuss.elastic.co/t/how-to-reduce-indices-space/126198
**Category:** Elasticsearch
**Created:** [March 30, 2018, 7:32am UTC](https://discuss.elastic.co/t/how-to-reduce-indices-space/126198 "2018-03-30T07:32:20Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@trelo](https://discuss.elastic.co/u/trelo)
#### Post date: [March 30, 2018, 7:32am UTC](https://discuss.elastic.co/t/how-to-reduce-indices-space/126198/1 "2018-03-30T07:32:20Z")
Hello,
recently I've upgraded my ELK from 5.6 to 6.2(and logstash's mapping templates too). And now I've noticed that new indices almost twice bigger than old indices with same amount of documents inside.
> **Here's logstash mapping:**
>
> ```
> {
> "template" : "logs-mail.log-*",
> "settings" : {
> "index.refresh_interval" : "5s",
> "number_of_shards": 2,
> "number_of_replicas": 0
> },
> "mappings" : {
> "_default_" : {
> "_all" : { "enabled" : false },
> "dynamic_templates" : [{
> "string_fields" : {
> "match" : "*",
> "match_mapping_type" : "string",
> "mapping" : {
> "type" : "keyword", "omit_norms" : true,
> "fielddata" : { "format" : "disabled" },
> "fields" : {
> "raw" : {"type": "keyword", "ignore_above" : 256}
>
> "properties" : {
> "@timestamp" : { "type" : "date" },
> "index_date" : { "type" : "keyword" },
> "server" : { "type" : "keyword" },
> "program" : { "type" : "keyword" },
> "dsn" : { "type" : "keyword" },
> "delay" : { "type" : "float" },
> "delays" : { "type" : "keyword" },
> "relay-ip" : { "type" : "ip" },
> "send-to" : { "type" : "keyword" },
> "delay" : { "type" : "float" },
> "conn_use" : { "type" : "integer" },
> "relay-port" : { "type" : "integer" },
> "queue-id" : { "type" : "keyword" },
> "status" : { "type" : "keyword" },
> "domain-rcpt" : { "type" : "keyword" },
> "relay-domain" : { "type" : "keyword" }
>
> ```
> **And mapping for new created index:**
>
> ```
> {
> "logs-mail.log-2018.03.30": {
> "mappings": {
> "doc": {
> "_all": {
> "enabled": false
> },
> "dynamic_templates": [
> {
> "string_fields": {
> "match": "*",
> "match_mapping_type": "string",
> "mapping": {
> "fielddata": {
> "format": "disabled"
> },
> "fields": {
> "raw": {
> "ignore_above": 256,
> "type": "keyword"
> }
> },
> "omit_norms": true,
> "type": "keyword"
> }
> }
> }
> ],
> "properties": {
> "@timestamp": {
> "type": "date"
> },
> "conn_use": {
> "type": "integer"
> },
> "delay": {
> "type": "float"
> },
> "delays": {
> "type": "keyword"
> },
> "domain-rcpt": {
> "type": "keyword"
> },
> "dsn": {
> "type": "keyword"
> },
> "index_date": {
> "type": "keyword"
> },
> "message": {
> "type": "keyword",
> "fields": {
> "raw": {
> "type": "keyword",
> "ignore_above": 256
> }
> }
> },
> "program": {
> "type": "keyword"
> },
> "queue-id": {
> "type": "keyword"
> },
> "relay": {
> "type": "keyword",
> "fields": {
> "raw": {
> "type": "keyword",
> "ignore_above": 256
> }
> }
> },
> "relay-domain": {
> "type": "keyword"
> },
> "relay-ip": {
> "type": "ip"
> },
> "relay-port": {
> "type": "integer"
> },
> "send-to": {
> "type": "keyword"
> },
> "server": {
> "type": "keyword"
> },
> "status": {
> "type": "keyword"
> },
> "tags": {
> "type": "keyword",
> "fields": {
> "raw": {
> "type": "keyword",
> "ignore_above": 256
> }
> }
> },
> "type": {
> "type": "keyword",
> "fields": {
> "raw": {
> "type": "keyword",
> "ignore_above": 256
>
> "_default_": {
> "_all": {
> "enabled": false
> },
> "dynamic_templates": [
> {
> "string_fields": {
> "match": "*",
> "match_mapping_type": "string",
> "mapping": {
> "fielddata": {
> "format": "disabled"
> },
> "fields": {
> "raw": {
> "ignore_above": 256,
> "type": "keyword"
> }
> },
> "omit_norms": true,
> "type": "keyword"
>
> "properties": {
> "@timestamp": {
> "type": "date"
> },
> "conn_use": {
> "type": "integer"
> },
> "delay": {
> "type": "float"
> },
> "delays": {
> "type": "keyword"
> },
> "domain-rcpt": {
> "type": "keyword"
> },
> "dsn": {
> "type": "keyword"
> },
> "index_date": {
> "type": "keyword"
> },
> "program": {
> "type": "keyword"
> },
> "queue-id": {
> "type": "keyword"
> },
> "relay-domain": {
> "type": "keyword"
> },
> "relay-ip": {
> "type": "ip"
> },
> "relay-port": {
> "type": "integer"
> },
> "send-to": {
> "type": "keyword"
> },
> "server": {
> "type": "keyword"
> },
> "status": {
> "type": "keyword"
> }
>
> ```
\*I've deleted braces to circumvent 7000 char limit
Looks like new indices is creating with extra fields, but why?
---
### Author:  [@trelo](https://discuss.elastic.co/u/trelo)
#### Post date: [April 9, 2018, 7:47am UTC](https://discuss.elastic.co/t/how-to-reduce-indices-space/126198/2 "2018-04-09T07:47:18Z")
The problem was with **\_all** block. Indexes size normalized after I removed **\_all** block
> **mail.json**
>
> ```
> {
> "order": 0,
> "index_patterns": [
> "logs-mail.log-*"
> ],
> "settings": {
> "index": {
> "number_of_shards": "2",
> "number_of_replicas": "0",
> "refresh_interval": "5s"
> }
> },
> "mappings": {
> "_default_": {
> "properties": {
> "@timestamp": {
> "type": "date"
> },
> "index_date": {
> "type": "keyword"
> },
> "server": {
> "type": "keyword"
> },
> "program": {
> "type": "keyword"
> },
> "dsn": {
> "type": "keyword"
> },
> "delay": {
> "type": "float"
> },
> "delays": {
> "type": "keyword"
> },
> "relay-ip": {
> "type": "ip"
> },
> "send-to": {
> "type": "keyword"
> },
> "conn_use": {
> "type": "integer"
> },
> "relay-port": {
> "type": "integer"
> },
> "queue-id": {
> "type": "keyword"
> },
> "status": {
> "type": "keyword"
> },
> "domain-rcpt": {
> "type": "keyword"
> },
> "relay-domain": {
> "type": "keyword"
> }
> }
> }
> },
> "aliases": {}
> }
>
> ```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 7, 2018, 7:59am UTC](https://discuss.elastic.co/t/how-to-reduce-indices-space/126198/3 "2018-05-07T07:59:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.